SCS-C02 Question 376
Select 2Your company manages sensitive customer data stored in Amazon S3. As part of the organization's security policy, you are tasked with implementing controls to manage the lifecycle of this data, ensuring that it is encrypted at all times and automatically deleted after a retention period of 5 years. Which combination of steps should you take to achieve this requirement?
- A
Use AWS Key Management Service (KMS) to enforce server-side encryption for all objects in the S3 bucket.
- B
Enable S3 Object Lock in compliance mode to prevent objects from being deleted before the 5-year retention period.
- C
Configure an S3 Lifecycle policy to automatically delete objects after 5 years.
- D
Use IAM policies to restrict access to the S3 bucket only to authorized users.
- E
Manually review and delete objects older than 5 years using the AWS Management Console.
Show answer and explanation
Correct answers: A, C
Explanation
To manage the lifecycle of data at rest in Amazon S3, encryption can be enforced using AWS KMS, ensuring compliance with data protection requirements. Additionally, an S3 Lifecycle policy is the recommended approach for automatically deleting data after a specific retention period, such as 5 years. These two steps together meet the requirements of encryption and lifecycle management, without relying on manual processes or conflicting features like S3 Object Lock.
- A. Correct.
Correct. AWS KMS can be used to enforce server-side encryption for all objects stored in an S3 bucket, ensuring data at rest is encrypted.
- B. Incorrect.
Incorrect. S3 Object Lock in compliance mode is often used for regulatory requirements to prevent deletion, but it conflicts with the requirement to delete data automatically after 5 years.
- C. Correct.
Correct. An S3 Lifecycle policy is the appropriate method to automatically delete objects after a specified retention period, in this case, 5 years.
- D. Incorrect.
Incorrect. While IAM policies are essential for access control, they do not directly address the need to manage the data lifecycle or enforce encryption.
- E. Incorrect.
Incorrect. Manually reviewing and deleting objects is inefficient and prone to human error, and it does not align with the goal of automating lifecycle management.